A design flaw in EvoDefi's MasterChef fork allowed attackers to arbitrage reward distribution by exploiting an incorrect update logic that failed to deduct minted rewards. The vulnerability allowed repeated reward claims without proper accounting.

EvoDefi, the project revenue farm on the BSC chain, was attacked, and the price of its token GEN dropped from US$2.1/piece to US$0.9/piece, a short-term drop of 57%. Loss of 455,576.85 GEN worth approximately USD 1 million. Due to the design flaws in the update logic of the function in the MasterChef contract, the part of the reward that needs to be deducted is not updated, which leads to arbitrage by the attacker.